shortcutxl 0.3.89 → 0.3.90
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/BINARY-INVENTORY.json +12 -12
- package/CHANGELOG.md +2 -1
- package/dist/app/local/tools/execute-code/approval-payload.d.ts +5 -1
- package/dist/app/local/tools/execute-code/executor.d.ts +4 -15
- package/dist/app/local/tools/execute-code/executor.js +56 -146
- package/dist/app/local/tools/execute-code/observability.js +0 -20
- package/dist/app/local/tools/execute-code/tool.js +0 -17
- package/dist/app/local/tools/execute-code/write-analyzer.js +2 -0
- package/dist/app/local/tools/take-screenshot/com-screenshot.js +8 -1
- package/dist/app/local/tools/take-screenshot/mog-screenshot.d.ts +0 -1
- package/dist/app/local/tools/take-screenshot/mog-screenshot.js +10 -17
- package/dist/app/modes/manage/prompt.js +1 -1
- package/dist/app/providers/model-resolver.js +1 -0
- package/dist/app/session/session-models.js +1 -1
- package/dist/app/tools/take-screenshot.d.ts +3 -0
- package/dist/app/tools/take-screenshot.js +5 -2
- package/dist/cli.js +129 -223
- package/dist/contracts/agent-snapshot.d.ts +14 -0
- package/dist/contracts/agent-snapshot.js +6 -0
- package/dist/core/agent-snapshot-builder.js +6 -2
- package/dist/core/prompts/take-screenshot.d.ts +1 -1
- package/dist/core/prompts/take-screenshot.js +1 -0
- package/dist/embedded-agent/compose.js +5 -4
- package/dist/embedded-agent/host-tools/take-screenshot/contract.d.ts +1 -1
- package/dist/embedded-agent/model-registry.d.ts +1 -0
- package/dist/embedded-agent/model-registry.js +1 -0
- package/dist/main.js +5 -3
- package/dist/model-ids.d.ts +4 -0
- package/dist/model-ids.js +10 -1
- package/dist/shortcut-model-catalog.js +12 -6
- package/dist/subagent-model-policy.js +1 -0
- package/native-app/main/index.js +2 -2
- package/native-app/package.json +1 -1
- package/native-app/renderer/assets/{index-SuRESuDS.js → index-Dep1w85F.js} +3 -3
- package/native-app/renderer/index.html +1 -1
- package/package.json +1 -1
- package/user-docs/dist/index.html +12 -24
- package/user-docs/security.md +4 -9
- package/xll/modules/shortcut_xl/_exec_entry.py +19 -4
- package/xll/modules/shortcut_xl/_exec_sandbox.py +2 -2
- package/xll/modules/shortcut_xl/_log.py +9 -2
- package/xll/modules/shortcut_xl/_threading.py +1 -1
- package/xll/python/Lib/site-packages/httpx-0.28.1.dist-info/RECORD +1 -1
- package/xll/python/Lib/site-packages/idna-3.18.dist-info/RECORD +1 -1
- package/xll/python/Lib/site-packages/pip-26.2.dist-info/RECORD +3 -3
- package/xll/python/Lib/site-packages/pywin32-311.dist-info/RECORD +2 -2
- package/xll/python/Scripts/httpx.exe +0 -0
- package/xll/python/Scripts/idna.exe +0 -0
- package/xll/python/Scripts/pip.exe +0 -0
- package/xll/python/Scripts/pip3.13.exe +0 -0
- package/xll/python/Scripts/pip3.exe +0 -0
- package/xll/python/Scripts/pywin32_postinstall.exe +0 -0
- package/xll/python/Scripts/pywin32_testall.exe +0 -0
package/BINARY-INVENTORY.json
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
|
-
"generatedAt": "2026-09-
|
|
3
|
+
"generatedAt": "2026-09-02T05:35:16.912Z",
|
|
4
4
|
"package": "shortcutxl",
|
|
5
5
|
"build": {
|
|
6
6
|
"builder": "github-actions",
|
|
7
7
|
"repository": "lyfegame/shortcut",
|
|
8
|
-
"sourceRef": "refs/heads/codex/
|
|
9
|
-
"sourceCommit": "
|
|
10
|
-
"workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/
|
|
11
|
-
"runId": "
|
|
8
|
+
"sourceRef": "refs/heads/codex/excel-preexecution-approval",
|
|
9
|
+
"sourceCommit": "2520273120cc4b4024d877790eacf6f41fefdd7c",
|
|
10
|
+
"workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/excel-preexecution-approval",
|
|
11
|
+
"runId": "33595155271",
|
|
12
12
|
"runnerOs": "Windows",
|
|
13
13
|
"runnerImage": "win25-vs2026",
|
|
14
14
|
"runnerImageVersion": "20260824.214.3"
|
|
@@ -550,7 +550,7 @@
|
|
|
550
550
|
},
|
|
551
551
|
{
|
|
552
552
|
"path": "xll/python/Scripts/httpx.exe",
|
|
553
|
-
"sha256": "
|
|
553
|
+
"sha256": "a7f8d80085b1d17fdf993cd7246d55f05726e3eb624859a8ba3b69b76368bd4c",
|
|
554
554
|
"source": "httpx console launcher installed into embedded Python",
|
|
555
555
|
"version": "see packaged httpx distribution",
|
|
556
556
|
"builtBy": "third-party",
|
|
@@ -558,7 +558,7 @@
|
|
|
558
558
|
},
|
|
559
559
|
{
|
|
560
560
|
"path": "xll/python/Scripts/idna.exe",
|
|
561
|
-
"sha256": "
|
|
561
|
+
"sha256": "75e2f1c65f561084f603823794d6ad5877ef0a5b1ef0b1fffff096603479642a",
|
|
562
562
|
"source": "Python package console launcher installed into embedded Python",
|
|
563
563
|
"version": "see owning Python package metadata in site-packages",
|
|
564
564
|
"builtBy": "third-party",
|
|
@@ -566,7 +566,7 @@
|
|
|
566
566
|
},
|
|
567
567
|
{
|
|
568
568
|
"path": "xll/python/Scripts/pip.exe",
|
|
569
|
-
"sha256": "
|
|
569
|
+
"sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
|
|
570
570
|
"source": "pip console launcher installed into embedded Python",
|
|
571
571
|
"version": "see packaged pip distribution",
|
|
572
572
|
"builtBy": "third-party",
|
|
@@ -574,7 +574,7 @@
|
|
|
574
574
|
},
|
|
575
575
|
{
|
|
576
576
|
"path": "xll/python/Scripts/pip3.13.exe",
|
|
577
|
-
"sha256": "
|
|
577
|
+
"sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
|
|
578
578
|
"source": "pip console launcher installed into embedded Python",
|
|
579
579
|
"version": "see packaged pip distribution",
|
|
580
580
|
"builtBy": "third-party",
|
|
@@ -582,7 +582,7 @@
|
|
|
582
582
|
},
|
|
583
583
|
{
|
|
584
584
|
"path": "xll/python/Scripts/pip3.exe",
|
|
585
|
-
"sha256": "
|
|
585
|
+
"sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
|
|
586
586
|
"source": "pip console launcher installed into embedded Python",
|
|
587
587
|
"version": "see packaged pip distribution",
|
|
588
588
|
"builtBy": "third-party",
|
|
@@ -590,7 +590,7 @@
|
|
|
590
590
|
},
|
|
591
591
|
{
|
|
592
592
|
"path": "xll/python/Scripts/pywin32_postinstall.exe",
|
|
593
|
-
"sha256": "
|
|
593
|
+
"sha256": "3d5142d3d301b5b22ec9f9ba2d29c9f8a4a73bad069389a73dafbd61e2b37696",
|
|
594
594
|
"source": "Python package console launcher installed into embedded Python",
|
|
595
595
|
"version": "see owning Python package metadata in site-packages",
|
|
596
596
|
"builtBy": "third-party",
|
|
@@ -598,7 +598,7 @@
|
|
|
598
598
|
},
|
|
599
599
|
{
|
|
600
600
|
"path": "xll/python/Scripts/pywin32_testall.exe",
|
|
601
|
-
"sha256": "
|
|
601
|
+
"sha256": "494be3de764340437d1fb12aaaefaf8f47c5a482f14834da3a17b080c71d6e16",
|
|
602
602
|
"source": "Python package console launcher installed into embedded Python",
|
|
603
603
|
"version": "see owning Python package metadata in site-packages",
|
|
604
604
|
"builtBy": "third-party",
|
package/CHANGELOG.md
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
-
## [0.3.
|
|
3
|
+
## [0.3.90]
|
|
4
4
|
|
|
5
5
|
- **Skill Forge** - A recursive self-improvement loop for skills. Create or improve personal skills by giving Skill Forge tasks and a grading bar to train, evaluate, and refine against.
|
|
6
|
+
- **Safer, more reliable Excel changes** - Shortcut now asks for approval before making workbook changes and allows longer operations to finish without timing out.
|
|
6
7
|
- **Credit usage at a glance** - See today's personal credit usage for non-teams users.
|
|
7
8
|
|
|
8
9
|
## [0.3.88]
|
|
@@ -6,6 +6,10 @@ export interface ExcelDiffApprovalPayload {
|
|
|
6
6
|
kind: 'diff';
|
|
7
7
|
description: string;
|
|
8
8
|
}
|
|
9
|
+
export interface ExcelWriteApprovalPayload {
|
|
10
|
+
kind: 'write';
|
|
11
|
+
description: string;
|
|
12
|
+
}
|
|
9
13
|
export interface OfficeDangerousApprovalPayload {
|
|
10
14
|
kind: 'dangerous';
|
|
11
15
|
description: string;
|
|
@@ -13,5 +17,5 @@ export interface OfficeDangerousApprovalPayload {
|
|
|
13
17
|
summary: string;
|
|
14
18
|
operations: OfficeApprovalOperation[];
|
|
15
19
|
}
|
|
16
|
-
export type OfficeApprovalPayload = ExcelDiffApprovalPayload | OfficeDangerousApprovalPayload;
|
|
20
|
+
export type OfficeApprovalPayload = ExcelDiffApprovalPayload | ExcelWriteApprovalPayload | OfficeDangerousApprovalPayload;
|
|
17
21
|
//# sourceMappingURL=approval-payload.d.ts.map
|
|
@@ -2,9 +2,9 @@
|
|
|
2
2
|
* COM execute_code executor — local XLL-backed execution lifecycle.
|
|
3
3
|
*
|
|
4
4
|
* Owns the COM-specific execution flow:
|
|
5
|
-
* 1.
|
|
6
|
-
* 2.
|
|
7
|
-
* 3.
|
|
5
|
+
* 1. Classify code and request write approval before execution
|
|
6
|
+
* 2. Send approved code to the local XLL via xllFetch
|
|
7
|
+
* 3. Parse and validate the response
|
|
8
8
|
*
|
|
9
9
|
* Used by:
|
|
10
10
|
* - `createExcelExecTool()` (COM ToolDefinition wrapper)
|
|
@@ -23,7 +23,7 @@ export interface ComExecResult {
|
|
|
23
23
|
cfTxId?: string;
|
|
24
24
|
editMode?: boolean;
|
|
25
25
|
}
|
|
26
|
-
export type ApprovalOutcome = 'accepted' | 'approval-unavailable' | 'failed' | '
|
|
26
|
+
export type ApprovalOutcome = 'accepted' | 'approval-unavailable' | 'failed' | 'rejected';
|
|
27
27
|
export interface LocalExecResult {
|
|
28
28
|
result: ComExecResult;
|
|
29
29
|
outcome: ApprovalOutcome;
|
|
@@ -33,19 +33,9 @@ export interface ExcelExecApprovalObservability {
|
|
|
33
33
|
onRequested?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
|
|
34
34
|
onAccepted?: (request: ApprovalRequest<OfficeApprovalPayload>, choice: ApprovalChoice) => void;
|
|
35
35
|
onRejected?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
|
|
36
|
-
onReverted?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
|
|
37
|
-
onRevertFailed?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
|
|
38
|
-
}
|
|
39
|
-
interface ApprovalResolution {
|
|
40
|
-
outcome: ApprovalOutcome;
|
|
41
|
-
approvalSummaries?: string[];
|
|
42
36
|
}
|
|
43
37
|
/** Validate that a parsed JSON value has the COM execute result shape. */
|
|
44
38
|
export declare function isComExecResult(v: unknown): v is ComExecResult;
|
|
45
|
-
/**
|
|
46
|
-
* Resolve approval for cell changes: show UI if needed, then revert or cleanup.
|
|
47
|
-
*/
|
|
48
|
-
export declare function resolveApproval(result: ComExecResult, approval: ApprovalGate<OfficeApprovalPayload> | undefined, postControl: (body: object) => Promise<Response>, ctx: ExtensionContext, description?: string, observability?: ExcelExecApprovalObservability, priorApprovalSummaries?: string[]): Promise<ApprovalResolution>;
|
|
49
39
|
/**
|
|
50
40
|
* Execute code against the local XLL and run approval.
|
|
51
41
|
*
|
|
@@ -60,5 +50,4 @@ export declare function executeComLocally(excelTarget: ExcelHostEndpoint, code:
|
|
|
60
50
|
observability?: ExcelExecApprovalObservability;
|
|
61
51
|
editModeTiming?: Partial<EditModeRetryTiming>;
|
|
62
52
|
}): Promise<LocalExecResult>;
|
|
63
|
-
export {};
|
|
64
53
|
//# sourceMappingURL=executor.d.ts.map
|
|
@@ -2,14 +2,13 @@
|
|
|
2
2
|
* COM execute_code executor — local XLL-backed execution lifecycle.
|
|
3
3
|
*
|
|
4
4
|
* Owns the COM-specific execution flow:
|
|
5
|
-
* 1.
|
|
6
|
-
* 2.
|
|
7
|
-
* 3.
|
|
5
|
+
* 1. Classify code and request write approval before execution
|
|
6
|
+
* 2. Send approved code to the local XLL via xllFetch
|
|
7
|
+
* 3. Parse and validate the response
|
|
8
8
|
*
|
|
9
9
|
* Used by:
|
|
10
10
|
* - `createExcelExecTool()` (COM ToolDefinition wrapper)
|
|
11
11
|
*/
|
|
12
|
-
import { log } from '../../../../shared/logging/agent-log.js';
|
|
13
12
|
import { INTERACTIVE_APPROVAL_UNAVAILABLE_MESSAGE } from '../../../approvals/approval-errors.js';
|
|
14
13
|
import { APPROVAL } from '../../../approvals/types.js';
|
|
15
14
|
import { getApprovalSurface, resolveApprovalExecutionDecision } from '../../../permissions/approval-surface.js';
|
|
@@ -31,13 +30,6 @@ export function isComExecResult(v) {
|
|
|
31
30
|
(r.error === undefined || typeof r.error === 'string') &&
|
|
32
31
|
(r.editMode === undefined || typeof r.editMode === 'boolean'));
|
|
33
32
|
}
|
|
34
|
-
// ---------------------------------------------------------------------------
|
|
35
|
-
// Control constants
|
|
36
|
-
// ---------------------------------------------------------------------------
|
|
37
|
-
const CONTROL = {
|
|
38
|
-
REVERT: 'revert',
|
|
39
|
-
CLEANUP: 'cleanup'
|
|
40
|
-
};
|
|
41
33
|
function describeExcelApprovalChoice(choice) {
|
|
42
34
|
switch (choice) {
|
|
43
35
|
case APPROVAL.ACCEPT:
|
|
@@ -97,95 +89,41 @@ async function requestAlwaysConfirmApproval(approval, ctx, description, dangerou
|
|
|
97
89
|
return { choice, unavailable: false };
|
|
98
90
|
}
|
|
99
91
|
// ---------------------------------------------------------------------------
|
|
100
|
-
//
|
|
92
|
+
// Pre-execution write approval
|
|
101
93
|
// ---------------------------------------------------------------------------
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
kind: 'execute_code',
|
|
111
|
-
title: 'Review Excel changes',
|
|
112
|
-
choices: [APPROVAL.ACCEPT, APPROVAL.ACCEPT_ALL, APPROVAL.REJECT],
|
|
113
|
-
payload: {
|
|
114
|
-
kind: 'diff',
|
|
115
|
-
description: description?.trim() || 'Updating Excel'
|
|
116
|
-
}
|
|
117
|
-
};
|
|
118
|
-
const decision = resolveApprovalExecutionDecision({
|
|
119
|
-
surface: getApprovalSurface(ctx),
|
|
120
|
-
gateAvailable: approval !== undefined,
|
|
121
|
-
isSafe: false,
|
|
122
|
-
isAutoApproved: approval?.isAutoApproved() ?? false,
|
|
123
|
-
alwaysRequireExplicitApproval: false,
|
|
124
|
-
allowHeadlessApproval: ctx.permissionPolicy?.office.allowHeadlessApproval ?? false
|
|
125
|
-
});
|
|
126
|
-
if (decision === 'prompt') {
|
|
127
|
-
if (!approval) {
|
|
128
|
-
observability?.onRejected?.(request);
|
|
129
|
-
try {
|
|
130
|
-
await postControl({ control: CONTROL.REVERT, cfTxId });
|
|
131
|
-
observability?.onReverted?.(request);
|
|
132
|
-
return { outcome: 'reverted' };
|
|
133
|
-
}
|
|
134
|
-
catch {
|
|
135
|
-
if (cfTxId != null) {
|
|
136
|
-
await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
|
|
137
|
-
}
|
|
138
|
-
observability?.onRevertFailed?.(request);
|
|
139
|
-
return { outcome: 'revert-failed' };
|
|
140
|
-
}
|
|
141
|
-
}
|
|
142
|
-
observability?.onRequested?.(request);
|
|
143
|
-
const choice = await approval.requestApproval(request, ctx);
|
|
144
|
-
if (choice === APPROVAL.REJECT || choice === undefined) {
|
|
145
|
-
observability?.onRejected?.(request);
|
|
146
|
-
try {
|
|
147
|
-
await postControl({ control: CONTROL.REVERT, cfTxId });
|
|
148
|
-
observability?.onReverted?.(request);
|
|
149
|
-
return { outcome: 'rejected' };
|
|
150
|
-
}
|
|
151
|
-
catch {
|
|
152
|
-
if (cfTxId != null) {
|
|
153
|
-
await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
|
|
154
|
-
}
|
|
155
|
-
observability?.onRevertFailed?.(request);
|
|
156
|
-
return { outcome: 'revert-failed' };
|
|
157
|
-
}
|
|
158
|
-
}
|
|
159
|
-
observability?.onAccepted?.(request, choice);
|
|
160
|
-
if (choice === APPROVAL.ACCEPT_ALL) {
|
|
161
|
-
approval.onAcceptAll();
|
|
162
|
-
}
|
|
163
|
-
approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
|
|
164
|
-
}
|
|
165
|
-
else if (decision === 'deny') {
|
|
166
|
-
observability?.onRejected?.(request);
|
|
167
|
-
try {
|
|
168
|
-
await postControl({ control: CONTROL.REVERT, cfTxId });
|
|
169
|
-
observability?.onReverted?.(request);
|
|
170
|
-
return { outcome: 'reverted' };
|
|
171
|
-
}
|
|
172
|
-
catch {
|
|
173
|
-
if (cfTxId != null) {
|
|
174
|
-
await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
|
|
175
|
-
}
|
|
176
|
-
observability?.onRevertFailed?.(request);
|
|
177
|
-
return { outcome: 'revert-failed' };
|
|
178
|
-
}
|
|
94
|
+
async function requestWriteApproval(approval, ctx, description, observability) {
|
|
95
|
+
const request = {
|
|
96
|
+
kind: 'execute_code',
|
|
97
|
+
title: 'Review Excel changes',
|
|
98
|
+
choices: [APPROVAL.ACCEPT, APPROVAL.ACCEPT_ALL, APPROVAL.REJECT],
|
|
99
|
+
payload: {
|
|
100
|
+
kind: 'write',
|
|
101
|
+
description: description?.trim() || 'Updating Excel'
|
|
179
102
|
}
|
|
103
|
+
};
|
|
104
|
+
const decision = resolveApprovalExecutionDecision({
|
|
105
|
+
surface: getApprovalSurface(ctx),
|
|
106
|
+
gateAvailable: approval !== undefined,
|
|
107
|
+
isSafe: false,
|
|
108
|
+
isAutoApproved: approval?.isAutoApproved() ?? false,
|
|
109
|
+
alwaysRequireExplicitApproval: false,
|
|
110
|
+
allowHeadlessApproval: ctx?.permissionPolicy?.office.allowHeadlessApproval ?? false
|
|
111
|
+
});
|
|
112
|
+
if (decision === 'allow') {
|
|
113
|
+
return { choice: APPROVAL.ACCEPT, unavailable: false, prompted: false };
|
|
180
114
|
}
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
115
|
+
if (decision === 'deny' || !approval || !ctx) {
|
|
116
|
+
observability?.onRejected?.(request);
|
|
117
|
+
return { choice: APPROVAL.REJECT, unavailable: true, prompted: false };
|
|
118
|
+
}
|
|
119
|
+
observability?.onRequested?.(request);
|
|
120
|
+
const choice = await approval.requestApproval(request, ctx);
|
|
121
|
+
if (choice === APPROVAL.REJECT || choice === undefined) {
|
|
122
|
+
observability?.onRejected?.(request);
|
|
123
|
+
return { choice, unavailable: false, prompted: true };
|
|
187
124
|
}
|
|
188
|
-
|
|
125
|
+
observability?.onAccepted?.(request, choice);
|
|
126
|
+
return { choice, unavailable: false, prompted: true };
|
|
189
127
|
}
|
|
190
128
|
// ---------------------------------------------------------------------------
|
|
191
129
|
// Core executor
|
|
@@ -200,7 +138,7 @@ export async function executeComLocally(excelTarget, code, options) {
|
|
|
200
138
|
const resolvedExcelHttpUrl = excelTarget.url;
|
|
201
139
|
const { approval, ctx, description, signal, observability, editModeTiming } = options ?? {};
|
|
202
140
|
let approvalSummaries;
|
|
203
|
-
const
|
|
141
|
+
const postExec = (body, sig) => xllFetch(`${resolvedExcelHttpUrl}/exec`, {
|
|
204
142
|
method: 'POST',
|
|
205
143
|
headers: { 'Content-Type': 'application/json' },
|
|
206
144
|
body: JSON.stringify(body),
|
|
@@ -224,7 +162,7 @@ export async function executeComLocally(excelTarget, code, options) {
|
|
|
224
162
|
const sendExecRequest = async () => {
|
|
225
163
|
let response;
|
|
226
164
|
try {
|
|
227
|
-
response = await
|
|
165
|
+
response = await postExec({ code, autoApprove: true }, signal);
|
|
228
166
|
}
|
|
229
167
|
catch (e) {
|
|
230
168
|
if (signal?.aborted || isEditModeAbortError(e)) {
|
|
@@ -237,7 +175,6 @@ export async function executeComLocally(excelTarget, code, options) {
|
|
|
237
175
|
};
|
|
238
176
|
// Static analysis: skip approval for code with no detectable writes.
|
|
239
177
|
const analysis = analyzeComWriteCode(code);
|
|
240
|
-
const dangerousLifecycleBypassed = analysis.alwaysRequireApproval && isDangerousExcelLifecycleBypassed(ctx);
|
|
241
178
|
if (analysis.alwaysRequireApproval) {
|
|
242
179
|
const approvalResult = await requestAlwaysConfirmApproval(approval, ctx, description, analysis.dangerousOperations, observability);
|
|
243
180
|
const { choice } = approvalResult;
|
|
@@ -257,25 +194,26 @@ export async function executeComLocally(excelTarget, code, options) {
|
|
|
257
194
|
}
|
|
258
195
|
approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
|
|
259
196
|
}
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
|
|
197
|
+
else if (!analysis.isReadOnly) {
|
|
198
|
+
const approvalResult = await requestWriteApproval(approval, ctx, description, observability);
|
|
199
|
+
const { choice } = approvalResult;
|
|
200
|
+
if (choice !== APPROVAL.ACCEPT && choice !== APPROVAL.ACCEPT_ALL) {
|
|
201
|
+
return {
|
|
202
|
+
result: {
|
|
203
|
+
ok: true,
|
|
204
|
+
output: approvalResult.unavailable
|
|
205
|
+
? INTERACTIVE_APPROVAL_UNAVAILABLE_MESSAGE
|
|
206
|
+
: 'Excel operation rejected by user.'
|
|
207
|
+
},
|
|
208
|
+
outcome: approvalResult.unavailable ? 'approval-unavailable' : 'rejected'
|
|
209
|
+
};
|
|
210
|
+
}
|
|
211
|
+
if (approvalResult.prompted && choice === APPROVAL.ACCEPT_ALL) {
|
|
212
|
+
approval?.onAcceptAll();
|
|
213
|
+
}
|
|
214
|
+
if (approvalResult.prompted) {
|
|
215
|
+
approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
|
|
216
|
+
}
|
|
279
217
|
}
|
|
280
218
|
let result = await sendExecRequest();
|
|
281
219
|
if (result.editMode) {
|
|
@@ -289,34 +227,6 @@ export async function executeComLocally(excelTarget, code, options) {
|
|
|
289
227
|
if (!result.ok) {
|
|
290
228
|
return { result, outcome: 'failed' };
|
|
291
229
|
}
|
|
292
|
-
if (ctx) {
|
|
293
|
-
const { outcome, approvalSummaries: resolvedApprovalSummaries } = await resolveApproval(result, approval, (b) => postControl(b), ctx, description, observability, approvalSummaries);
|
|
294
|
-
return { result, outcome, approvalSummaries: resolvedApprovalSummaries };
|
|
295
|
-
}
|
|
296
|
-
if (result.diff) {
|
|
297
|
-
try {
|
|
298
|
-
await postControl({ control: CONTROL.REVERT, cfTxId: result.cfTxId });
|
|
299
|
-
return {
|
|
300
|
-
result: { ...result, output: 'Excel operation rejected by user.' },
|
|
301
|
-
outcome: 'reverted'
|
|
302
|
-
};
|
|
303
|
-
}
|
|
304
|
-
catch {
|
|
305
|
-
if (result.cfTxId != null) {
|
|
306
|
-
await postControl({ control: CONTROL.CLEANUP, cfTxId: result.cfTxId }).catch(() => { });
|
|
307
|
-
}
|
|
308
|
-
return {
|
|
309
|
-
result: { ...result, output: 'Excel operation rejected by user.' },
|
|
310
|
-
outcome: 'revert-failed'
|
|
311
|
-
};
|
|
312
|
-
}
|
|
313
|
-
}
|
|
314
|
-
if (result.cfTxId != null) {
|
|
315
|
-
await postControl({ control: CONTROL.CLEANUP, cfTxId: result.cfTxId }).catch((e) => {
|
|
316
|
-
const msg = e instanceof Error ? e.message : String(e);
|
|
317
|
-
log.error('excel-exec', `CF cleanup failed for tx ${result.cfTxId}: ${msg}`);
|
|
318
|
-
});
|
|
319
|
-
}
|
|
320
230
|
return { result, outcome: 'accepted', approvalSummaries };
|
|
321
231
|
}
|
|
322
232
|
//# sourceMappingURL=executor.js.map
|
|
@@ -31,26 +31,6 @@ export function createExecuteCodeApprovalObservability(clientLogger) {
|
|
|
31
31
|
approval_kind: request.payload.kind
|
|
32
32
|
}
|
|
33
33
|
});
|
|
34
|
-
},
|
|
35
|
-
onReverted: (request) => {
|
|
36
|
-
clientLogger.info({
|
|
37
|
-
module: 'tool',
|
|
38
|
-
event: 'tool_approval_reverted',
|
|
39
|
-
data: {
|
|
40
|
-
tool_name: TOOL_NAME,
|
|
41
|
-
approval_kind: request.payload.kind
|
|
42
|
-
}
|
|
43
|
-
});
|
|
44
|
-
},
|
|
45
|
-
onRevertFailed: (request) => {
|
|
46
|
-
clientLogger.error({
|
|
47
|
-
module: 'tool',
|
|
48
|
-
event: 'tool_approval_revert_failed',
|
|
49
|
-
data: {
|
|
50
|
-
tool_name: TOOL_NAME,
|
|
51
|
-
approval_kind: request.payload.kind
|
|
52
|
-
}
|
|
53
|
-
});
|
|
54
34
|
}
|
|
55
35
|
};
|
|
56
36
|
}
|
|
@@ -81,23 +81,6 @@ export function createExcelExecTool(resolveTarget, approval, observability) {
|
|
|
81
81
|
ctx: ctx,
|
|
82
82
|
signal: signal ?? undefined
|
|
83
83
|
});
|
|
84
|
-
if (outcome === 'revert-failed') {
|
|
85
|
-
return {
|
|
86
|
-
content: [
|
|
87
|
-
{
|
|
88
|
-
type: 'text',
|
|
89
|
-
text: 'Revert failed — changes are still applied in Excel. You may need to undo manually (Ctrl+Z).'
|
|
90
|
-
}
|
|
91
|
-
],
|
|
92
|
-
details: result
|
|
93
|
-
};
|
|
94
|
-
}
|
|
95
|
-
if (outcome === 'reverted') {
|
|
96
|
-
return {
|
|
97
|
-
content: [{ type: 'text', text: 'Changes reverted by user.' }],
|
|
98
|
-
details: result
|
|
99
|
-
};
|
|
100
|
-
}
|
|
101
84
|
if (outcome === 'rejected') {
|
|
102
85
|
return {
|
|
103
86
|
content: [{ type: 'text', text: USER_REJECTED_APPROVAL_MESSAGE }],
|
|
@@ -13,6 +13,7 @@ async function captureComScreenshot(host, range, signal) {
|
|
|
13
13
|
headers: { 'Content-Type': 'application/json' },
|
|
14
14
|
body: JSON.stringify({
|
|
15
15
|
control: 'screenshot',
|
|
16
|
+
workbook: range.workbook,
|
|
16
17
|
sheet: range.sheet,
|
|
17
18
|
range: range.cell_range
|
|
18
19
|
}),
|
|
@@ -43,6 +44,7 @@ export async function captureComScreenshots(ranges, signal, resolveTarget) {
|
|
|
43
44
|
const msg = error instanceof Error ? error.message : String(error);
|
|
44
45
|
console.error(`[take_screenshot] COM capture unavailable: ${msg}`);
|
|
45
46
|
return ranges.map((range) => ({
|
|
47
|
+
workbook: range.workbook,
|
|
46
48
|
sheet: range.sheet,
|
|
47
49
|
cell_range: range.cell_range,
|
|
48
50
|
data: null
|
|
@@ -58,7 +60,12 @@ export async function captureComScreenshots(ranges, signal, resolveTarget) {
|
|
|
58
60
|
const msg = error instanceof Error ? error.message : String(error);
|
|
59
61
|
console.error(`[take_screenshot] COM capture failed for ${range.sheet}!${range.cell_range}: ${msg}`);
|
|
60
62
|
}
|
|
61
|
-
screenshots.push({
|
|
63
|
+
screenshots.push({
|
|
64
|
+
workbook: range.workbook,
|
|
65
|
+
sheet: range.sheet,
|
|
66
|
+
cell_range: range.cell_range,
|
|
67
|
+
data
|
|
68
|
+
});
|
|
62
69
|
}
|
|
63
70
|
return screenshots;
|
|
64
71
|
}
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import type { Screenshot, ScreenshotRange } from '../../../tools/take-screenshot.js';
|
|
2
2
|
interface MogSheetPoolWithScreenshots {
|
|
3
|
-
activeWorkbookName: string | null | undefined;
|
|
4
3
|
getWorkbook(name: string): unknown;
|
|
5
4
|
}
|
|
6
5
|
export declare function captureMogScreenshots(pool: MogSheetPoolWithScreenshots, ranges: ScreenshotRange[], _signal?: AbortSignal): Promise<Screenshot[]>;
|
|
@@ -4,26 +4,14 @@ function isMogWorkbookWithScreenshots(value) {
|
|
|
4
4
|
typeof value.captureScreenshot === 'function');
|
|
5
5
|
}
|
|
6
6
|
export async function captureMogScreenshots(pool, ranges, _signal) {
|
|
7
|
-
if (!pool.activeWorkbookName) {
|
|
8
|
-
return ranges.map((range) => ({
|
|
9
|
-
sheet: range.sheet,
|
|
10
|
-
cell_range: range.cell_range,
|
|
11
|
-
data: null
|
|
12
|
-
}));
|
|
13
|
-
}
|
|
14
|
-
const workbook = pool.getWorkbook(pool.activeWorkbookName);
|
|
15
|
-
if (!isMogWorkbookWithScreenshots(workbook)) {
|
|
16
|
-
console.error('[take_screenshot] Active Mog workbook does not support screenshot capture');
|
|
17
|
-
return ranges.map((range) => ({
|
|
18
|
-
sheet: range.sheet,
|
|
19
|
-
cell_range: range.cell_range,
|
|
20
|
-
data: null
|
|
21
|
-
}));
|
|
22
|
-
}
|
|
23
7
|
const screenshots = [];
|
|
24
8
|
for (const range of ranges) {
|
|
25
9
|
let data = null;
|
|
26
10
|
try {
|
|
11
|
+
const workbook = pool.getWorkbook(range.workbook);
|
|
12
|
+
if (!isMogWorkbookWithScreenshots(workbook)) {
|
|
13
|
+
throw new Error(`Workbook does not support screenshot capture: ${range.workbook}`);
|
|
14
|
+
}
|
|
27
15
|
const pngBuffer = await workbook.captureScreenshot(range.sheet, range.cell_range);
|
|
28
16
|
data = Buffer.from(pngBuffer).toString('base64');
|
|
29
17
|
}
|
|
@@ -31,7 +19,12 @@ export async function captureMogScreenshots(pool, ranges, _signal) {
|
|
|
31
19
|
const msg = error instanceof Error ? error.message : String(error);
|
|
32
20
|
console.error(`[take_screenshot] Mog capture failed for ${range.sheet}!${range.cell_range}: ${msg}`);
|
|
33
21
|
}
|
|
34
|
-
screenshots.push({
|
|
22
|
+
screenshots.push({
|
|
23
|
+
workbook: range.workbook,
|
|
24
|
+
sheet: range.sheet,
|
|
25
|
+
cell_range: range.cell_range,
|
|
26
|
+
data
|
|
27
|
+
});
|
|
35
28
|
}
|
|
36
29
|
return screenshots;
|
|
37
30
|
}
|
|
@@ -65,7 +65,7 @@ Launch verification subagent(s) in the background to check results against requi
|
|
|
65
65
|
|
|
66
66
|
- **NEVER** write "based on your findings, implement X" — this pushes synthesis onto the subagent. YOU must synthesize research results and write precise instructions.
|
|
67
67
|
- **NEVER** delegate understanding. Read subagent outputs, extract what matters, then write specific implementation instructions.
|
|
68
|
-
- **NEVER**
|
|
68
|
+
- **NEVER** spawn a replacement until the original subagent has stopped, and never resume the original afterward.
|
|
69
69
|
- **NEVER** give vague instructions like "fix the formatting" — specify which cells, which format, which style.
|
|
70
70
|
|
|
71
71
|
## Delegation Format
|
|
@@ -34,7 +34,7 @@ export const ALL_THINKING_LEVELS = [
|
|
|
34
34
|
/** Models shown in interactive model controls for known providers. Unlisted providers show all. */
|
|
35
35
|
const INTERACTIVE_MODELS_PER_PROVIDER = {
|
|
36
36
|
shortcut: new Set([
|
|
37
|
-
SHORTCUT_MODEL_ID.
|
|
37
|
+
SHORTCUT_MODEL_ID.ClaudeFable51,
|
|
38
38
|
SHORTCUT_MODEL_ID.ClaudeOpus5,
|
|
39
39
|
SHORTCUT_OPENAI_MODEL_ID,
|
|
40
40
|
SHORTCUT_MODEL_ID.Gpt56Luna,
|
|
@@ -18,10 +18,12 @@
|
|
|
18
18
|
import type { ToolDefinition } from '../../core/core-types.js';
|
|
19
19
|
import { type ShortcutLlmProxyClient } from '../providers/shortcut-llm-proxy-client.js';
|
|
20
20
|
export interface ScreenshotRange {
|
|
21
|
+
workbook: string;
|
|
21
22
|
sheet: string;
|
|
22
23
|
cell_range: string;
|
|
23
24
|
}
|
|
24
25
|
export interface Screenshot {
|
|
26
|
+
workbook: string;
|
|
25
27
|
sheet: string;
|
|
26
28
|
cell_range: string;
|
|
27
29
|
/** Base64-encoded PNG data. Null/undefined means capture failed for this range. */
|
|
@@ -49,6 +51,7 @@ export interface TakeScreenshotOperations {
|
|
|
49
51
|
}
|
|
50
52
|
declare const schema: import("@sinclair/typebox").TObject<{
|
|
51
53
|
ranges: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
|
|
54
|
+
workbook: import("@sinclair/typebox").TString;
|
|
52
55
|
sheet: import("@sinclair/typebox").TString;
|
|
53
56
|
cell_range: import("@sinclair/typebox").TString;
|
|
54
57
|
}>>;
|
|
@@ -33,6 +33,9 @@ const DESCRIPTION = TAKE_SCREENSHOT_TOOL_DESCRIPTION;
|
|
|
33
33
|
// Schema
|
|
34
34
|
// ---------------------------------------------------------------------------
|
|
35
35
|
const RangeSchema = Type.Object({
|
|
36
|
+
workbook: Type.String({
|
|
37
|
+
description: 'Exact workbook name to capture, such as "Model.xlsx". Use the name only, not a path.'
|
|
38
|
+
}),
|
|
36
39
|
sheet: Type.String({ description: 'Sheet name to capture.' }),
|
|
37
40
|
cell_range: Type.String({ description: 'Range to capture, e.g. "A1:G10".' })
|
|
38
41
|
});
|
|
@@ -135,7 +138,7 @@ export function createTakeScreenshotTool(operations = defaultOperations) {
|
|
|
135
138
|
// Filter to valid screenshots (those with data)
|
|
136
139
|
const validScreenshots = screenshots.filter((ss) => ss.data);
|
|
137
140
|
if (validScreenshots.length === 0) {
|
|
138
|
-
const rangesStr = ranges.map((r) => `${r.sheet}!${r.cell_range}`).join(', ');
|
|
141
|
+
const rangesStr = ranges.map((r) => `${r.workbook}:${r.sheet}!${r.cell_range}`).join(', ');
|
|
139
142
|
return {
|
|
140
143
|
content: [
|
|
141
144
|
{
|
|
@@ -151,7 +154,7 @@ export function createTakeScreenshotTool(operations = defaultOperations) {
|
|
|
151
154
|
try {
|
|
152
155
|
const result = await operations.analyzeWithVisionLLM(validScreenshots, query, selectedModel, extCtx.shortcutLlmProxy, signal ?? undefined);
|
|
153
156
|
const rangesSummary = validScreenshots
|
|
154
|
-
.map((ss) => `${ss.sheet}!${ss.cell_range}`)
|
|
157
|
+
.map((ss) => `${ss.workbook}:${ss.sheet}!${ss.cell_range}`)
|
|
155
158
|
.join(', ');
|
|
156
159
|
return {
|
|
157
160
|
content: [{ type: 'text', text: result.text }],
|